Skip to content

Adding a '+' to the phone number before hashing should be mandatory, not optional #65

@eric-murray

Description

@eric-murray

Problem description
Phone number optionally prefixed with '+' before hashing? Why is this an option?

    NumberVerificationRequestBody:
        ...
        hashedPhoneNumber:
          description: Hashed phone number. SHA-256 (in hexadecimal representation) of the mobile phone number in **E.164 format (starting with country code)**. Optionally prefixed with '+'.

This means that the supplied hashed phone number must be compared to two hashes of the true phone number to determine if they match. Some have claimed this is a "feature" for those who cannot read a specification or format phone numbers properly, but I think this is a bug that increases implementation complexity and processing time.

Expected behaviour
Adding '+' before hashing should be mandatory

    NumberVerificationRequestBody:
        ...
        hashedPhoneNumber:
          description: Hashed phone number. SHA-256 (in hexadecimal representation) of the mobile phone number in **E.164 format (starting with country code and mandatorily prefixed by '+')**

Alternative solution
Remove option for hashing completely. It adds no data security for such a small plaintext space.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions